@warble/claude-agent-sdk 0.12.0 → 0.13.0

package/dist/index.d.ts

@@ -108,6 +108,12 @@ interface LlmCall {
      * prompt text instead.
      */
     when: WhenGuard | null;
+    /** Same-profile component aliases this exact step may invoke. */
+    component_calls: ComponentCall[];
+}
+interface ComponentCall {
+    alias: string;
+    component: string;
 }
 /**
  * A closed-vocabulary guard on a conditional `llm_call`: `guard` is one of `on_failure` /
@@ -187,8 +193,21 @@ interface SlotDecl {
     /** Present only when the author declared a condition. Carried verbatim; not interpreted here. */
     present_when?: unknown;
 }
+/**
+ * One file a component declares it needs, by identity (IR 0.7).
+ *
+ * Content is deliberately not carried — the deliberate contrast with a slot variant, whose text is.
+ * `hash` is `sha256:<hex>` over the bytes and neither field is authorable; both are computed at
+ * compile, so an author-written value cannot rot into a claim nothing keeps true.
+ */
+interface AssetDecl {
+    path: string;
+    hash: string;
+    bytes: number;
+}
 interface ComponentNode {
     id: string;
+    entrypoint: boolean;
     verb: string;
     type: ComponentType;
     realization_kind: RealizationKind;
@@ -211,6 +230,8 @@ interface ComponentNode {
     /** Slots belonging to THIS component's own prompt text (its steps and `brief`). Profile-level
      *  slots live on the IR root instead and are deliberately not copied here. */
     slots?: SlotDecl[];
+    /** Files this component declares it needs, by identity. Absent when it declares none. */
+    assets?: AssetDecl[];
 }
 interface WarbleIr {
     warble_ir_version: string;
@@ -237,74 +258,108 @@ declare function parseIr(json: string): WarbleIr;
 /** Distinct tier names across a node's `llm_calls`, order-preserving. */
 declare function distinctTiers(calls: readonly LlmCall[]): string[];
 
+/** One statically-authorized caller-step edge in the materialized profile. */
+interface ComponentDependency {
+    caller: string;
+    step: string;
+    alias: string;
+    component: string;
+}
+/** The deterministic transitive closure for one selectable root. */
+interface EntryClosure {
+    root: string;
+    components: readonly string[];
+}
 /**
- * Target capability profiles — the declarative side of the capability model
- * (`docs/spec/capability-model.md`), owned by THIS back-end in TypeScript.
+ * Preparation selection before target legalization. `roots` are the only nodes an operation may
+ * start; `callees` are addressable only through an edge in `dependencies`.
+ */
+interface ComponentClosurePlan {
+    roots: readonly ComponentNode[];
+    callees: readonly ComponentNode[];
+    components: readonly ComponentNode[];
+    entries: readonly EntryClosure[];
+    dependencies: readonly ComponentDependency[];
+}
+/** Return all declared edges in profile/step/declaration order. */
+declare function componentDependencies(ir: WarbleIr): readonly ComponentDependency[];
+/**
+ * Resolve exactly the requested roots and their transitive callees. The reader rechecks the graph
+ * rather than trusting compiler provenance so a forged object IR cannot widen or cycle authority.
+ */
+declare function resolveComponentClosure(ir: WarbleIr, requestedRoots?: readonly string[]): ComponentClosurePlan;
+
+/**
+ * What a host says about each slot, keyed by slot name:
  *
- * A runtime target is `engine × mode`. This back-end declares one target, `claude-agent-sdk:local`:
- * the local `@anthropic-ai/claude-agent-sdk` `query()` loop (subscription login, compute on the
- * user's machine). The shared thing across back-ends is the IR + the capability-model
- * *semantics* (native / realize-via / degrade / fail, criticality, provided_by); the profile *data*
- * is target-specific and each back-end writes its own. So this file is the TS sibling of
- * the Rust file target's `targets.rs`, not a shared table.
+ * - a string — render this variant;
+ * - `null` — the slot's `present_when` does not hold, so remove it entirely;
+ * - absent — the host has no opinion, so render the declared `default`.
  *
- * How `local` differs from the Rust file target's `claude-code:headless` (the point of the second
- * back-end):
- *   - `llm:per_step_tier`        native (in-loop per-call model)   ← headless: realize-via(subagents)
- *   - `structured_output_capture` native (message stream)          ← headless: native(stream-json)
- *   - `render_contract`          realize-via(warble-render)         ← headless: realize-via(html-file)
- * The rest match headless, including the safety-critical loud-fails (human_approval, blast_radius).
+ * A plain table rather than a callback, so what the model was told is decided before the run rather
+ * than during it: it can be recorded, compared and fingerprinted. A callback could not be.
  */
-/** One of the four resolution outcomes a capability can take on a target. */
-type CapabilityOutcome = "native" | "realize-via" | "degrade" | "fail";
-/** Who supplies a resolved capability. */
-type ProvidedBy = "runtime" | "warble" | "none";
+type SlotSupply = Readonly<Record<string, string | null>>;
 /**
- * safety-critical capabilities must never silently degrade — unsupported means the resolution pass
- * aborts. required/best-effort may degrade with a warning recorded in the report.
+ * What to do with a conditional slot the host did not answer.
+ *
+ * `"fail"` on any path whose text reaches a model: `default` covers "no opinion on the wording", and
+ * it cannot cover "no opinion on whether this exists at all" — defaulting there ships instructions
+ * for a capability that may have been withheld, which is the failure `present_when` exists to
+ * prevent.
+ *
+ * `"default"` on a display path. The rule above protects a model, not a reader, and a structural
+ * view that refuses to render a valid profile is worse than one showing the default wording. Note
+ * this is a real difference in meaning, not a relaxation for convenience: a display says "this is
+ * what the default binding would say", never "this is what will be sent".
  */
-type Criticality = "safety-critical" | "required" | "best-effort";
-interface CapabilityEntry {
-    outcome: CapabilityOutcome;
-    via: string | null;
-    provided_by: ProvidedBy;
-    criticality: Criticality;
-    note: string | null;
-}
-type CapabilityProfile = Record<string, CapabilityEntry>;
-/** The one target this back-end declares (engine × mode). */
-type TargetId = "claude-agent-sdk:local";
-declare const DEFAULT_TARGET: TargetId;
-declare function isKnownTarget(value: string): value is TargetId;
-declare function knownTargetNames(): readonly string[];
-/** Capability profile for `claude-agent-sdk:local`. */
-declare function localProfile(): CapabilityProfile;
-/** Resolve a target id to its capability profile, or `null` if unknown. */
-declare function profileFor(targetId: string): CapabilityProfile | null;
-
-interface ResolvedCapability {
-    capability: string;
-    outcome: CapabilityOutcome;
-    provided_by: ProvidedBy;
-    criticality: Criticality;
-    note?: string;
-}
-type ResolutionReport = ResolvedCapability[];
-/** Union of declared + implied required capabilities, de-duplicated, order-preserving. */
-declare function collectRequiredCapabilities(node: ComponentNode): string[];
-declare function resolveCapabilities(node: ComponentNode, targetId: string, profile: CapabilityProfile): ResolutionReport;
+type UnansweredCondition = "fail" | "default";
 /**
- * Resolve one node's required capabilities against `targetId`, erroring on any `fail` outcome
- * (no silent degradation). Callers must not dispatch when this throws.
+ * Resolve each declared slot to the text that will replace its references, or to `null` when the
+ * host said it is not present.
+ *
+ * A slot's chosen variant may itself reference other slots — the compiler collects references from
+ * variant text and validates them, so this is authored-legal — hence the recursion, with a visiting
+ * set so a cycle is reported rather than spun on.
+ *
+ * @param decls every slot in scope for the text being resolved. That is the profile's slots PLUS
+ *   the component's, together: compile checks the two layers separately, but it also folds the
+ *   profile's `system_prompt` into each component's `brief` (`render_brief`), so by the time a
+ *   consumer sees the IR one string carries references from both. Names are unique project-wide —
+ *   compile refuses a collision — which is what makes one combined table unambiguous.
+ * @param supply the host's table.
+ * @param scope names the scope in errors ("component 'x'").
  */
-declare function resolveNodeCapabilities(node: ComponentNode, targetId: string): ResolutionReport;
+declare function resolveSlots(decls: readonly SlotDecl[], supply: SlotSupply, scope: string, unanswered?: UnansweredCondition): ReadonlyMap<string, string | null>;
 /**
- * Read-only inspection counterpart to `resolveNodeCapabilities`. It returns
- * the same report, including a failed entry, but does not legalize execution.
- * Only display-only callers may use this; dispatch/emit/chat retain the loud
- * failure above.
+ * Apply a resolved scope to one piece of prompt text.
+ *
+ * A slot resolved to `null` leaves nothing behind — deliberately the empty string rather than any
+ * variant, since the point of a condition that does not hold is that the wording must not appear.
  */
-declare function inspectNodeCapabilities(node: ComponentNode, targetId: string): ResolutionReport;
+declare function applySlots(raw: string, resolved: ReadonlyMap<string, string | null>, scope: string): string;
+/**
+ * Refuse prompt text that still carries a slot reference.
+ *
+ * The guard, not a formality. Every other failure in this file is loud on its own; this one catches
+ * the case where a surface was never routed through {@link applySlots} at all — a new prompt-carrying
+ * field, a path that assembles text somewhere unexpected — which is exactly how the original defect
+ * arrived: the IR grew slots and nothing downstream was taught to consume them.
+ */
+declare function assertNoSlotReferences(raw: string, owner: string): void;
+/**
+ * Parse repeated `--slot name=variant` / `--slot name=` flags into a {@link SlotSupply}.
+ *
+ * Lives here rather than in the CLI so it is reachable by a test and by any host that wants the same
+ * surface; the CLI turns the thrown error into its own usage failure. Mirrors the Rust CLI's flag of
+ * the same name — two user-facing surfaces that disagreed about what `name=` means would be worse
+ * than either one alone.
+ *
+ * An empty value is **not** an empty variant name: it is the host saying the slot's condition does
+ * not hold and the wording must not appear at all. That distinction is why the flag takes a trailing
+ * `=` rather than requiring a variant.
+ */
+declare function parseSlotFlags(flags: readonly string[]): SlotSupply;
 
 /**
  * Which provider serves a tier's model — an **open string**, opaque to warble (mirrors how the IR
@@ -378,6 +433,76 @@ declare class ModelConfig {
     validate(ir: WarbleIr): void;
 }
 
+/**
+ * Target capability profiles — the declarative side of the capability model
+ * (`docs/spec/capability-model.md`), owned by THIS back-end in TypeScript.
+ *
+ * A runtime target is `engine × mode`. This back-end declares one target, `claude-agent-sdk:local`:
+ * the local `@anthropic-ai/claude-agent-sdk` `query()` loop (subscription login, compute on the
+ * user's machine). The shared thing across back-ends is the IR + the capability-model
+ * *semantics* (native / realize-via / degrade / fail, criticality, provided_by); the profile *data*
+ * is target-specific and each back-end writes its own. So this file is the TS sibling of
+ * the Rust file target's `targets.rs`, not a shared table.
+ *
+ * How `local` differs from the Rust file target's `claude-code:headless` (the point of the second
+ * back-end):
+ *   - `llm:per_step_tier`        native (in-loop per-call model)   ← headless: realize-via(subagents)
+ *   - `structured_output_capture` native (message stream)          ← headless: native(stream-json)
+ *   - `render_contract`          realize-via(warble-render)         ← headless: realize-via(html-file)
+ * The rest match headless, including the safety-critical loud-fails (human_approval, blast_radius).
+ */
+/** One of the four resolution outcomes a capability can take on a target. */
+type CapabilityOutcome = "native" | "realize-via" | "degrade" | "fail";
+/** Who supplies a resolved capability. */
+type ProvidedBy = "runtime" | "warble" | "none";
+/**
+ * safety-critical capabilities must never silently degrade — unsupported means the resolution pass
+ * aborts. required/best-effort may degrade with a warning recorded in the report.
+ */
+type Criticality = "safety-critical" | "required" | "best-effort";
+interface CapabilityEntry {
+    outcome: CapabilityOutcome;
+    via: string | null;
+    provided_by: ProvidedBy;
+    criticality: Criticality;
+    note: string | null;
+}
+type CapabilityProfile = Record<string, CapabilityEntry>;
+/** The one target this back-end declares (engine × mode). */
+type TargetId = "claude-agent-sdk:local";
+declare const DEFAULT_TARGET: TargetId;
+declare function isKnownTarget(value: string): value is TargetId;
+declare function knownTargetNames(): readonly string[];
+/** Capability profile for `claude-agent-sdk:local`. */
+declare function localProfile(): CapabilityProfile;
+/** Resolve a target id to its capability profile, or `null` if unknown. */
+declare function profileFor(targetId: string): CapabilityProfile | null;
+
+interface ResolvedCapability {
+    capability: string;
+    outcome: CapabilityOutcome;
+    via?: string;
+    provided_by: ProvidedBy;
+    criticality: Criticality;
+    note?: string;
+}
+type ResolutionReport = ResolvedCapability[];
+/** Union of declared + implied required capabilities, de-duplicated, order-preserving. */
+declare function collectRequiredCapabilities(node: ComponentNode): string[];
+declare function resolveCapabilities(node: ComponentNode, targetId: string, profile: CapabilityProfile): ResolutionReport;
+/**
+ * Resolve one node's required capabilities against `targetId`, erroring on any `fail` outcome
+ * (no silent degradation). Callers must not dispatch when this throws.
+ */
+declare function resolveNodeCapabilities(node: ComponentNode, targetId: string): ResolutionReport;
+/**
+ * Read-only inspection counterpart to `resolveNodeCapabilities`. It returns
+ * the same report, including a failed entry, but does not legalize execution.
+ * Only display-only callers may use this; dispatch/emit/chat retain the loud
+ * failure above.
+ */
+declare function inspectNodeCapabilities(node: ComponentNode, targetId: string): ResolutionReport;
+
 /**
  * Per-step provider routing — the hybrid-LLM core (see docs/spec/capability-model.md §7.2).
  *
@@ -455,47 +580,6 @@ interface StepMessage {
  */
 declare function buildStepMessages(step: StagedStep, question: string, artifacts: Readonly<Record<string, string>>): StepMessage[];
 
-/**
- * Minimal OpenAI-compatible chat client for the hybrid-staged path (see docs/spec/capability-model.md §7.2).
- *
- * A local step (provider `openai_compat`, e.g. ollama's `http://localhost:11434/v1`) is executed by
- * calling `POST {endpoint}/chat/completions` directly — NOT through the Claude SDK, whose `agents[].model`
- * is a restricted alias union that loud-fails on a local model id (SDK-NOTES.md #1). ollama speaks the
- * OpenAI Chat Completions shape, not the Anthropic Messages shape, so this is a distinct, deliberately
- * tiny client — no streaming, no tools, no retries. It is the "third provider-aware back-end" embryo:
- * enough to prove a per-step local model can be marshaled into a cloud run, not a production LLM client.
- *
- * Live-gated: exercised only when an ollama (or other OpenAI-compat) endpoint is reachable. The request
- * SHAPING is unit-tested via {@link buildChatRequest} with no network.
- */
-
-interface ChatRequest {
-    model: string;
-    messages: StepMessage[];
-    stream: false;
-    /** Deterministic-leaning default; a local step is a bounded transform, not open-ended generation. */
-    temperature: number;
-}
-/** Build the JSON body for an OpenAI-compatible `/chat/completions` call. Pure (no network). */
-declare function buildChatRequest(model: string, messages: StepMessage[]): ChatRequest;
-/** Extract the assistant text from an OpenAI-compatible completion response. Pure. */
-declare function extractCompletionText(body: unknown): string;
-interface CallLocalOptions {
-    endpoint: string;
-    model: string;
-    messages: StepMessage[];
-    /** Optional bearer token (ollama ignores it; other OpenAI-compat servers may require it). */
-    apiKey?: string;
-    /** Injectable for tests; defaults to global fetch. */
-    fetchImpl?: typeof fetch;
-}
-/**
- * Call an OpenAI-compatible chat endpoint and return the assistant text. Live-gated (needs a reachable
- * endpoint); the request/response shaping is covered by {@link buildChatRequest} /
- * {@link extractCompletionText} tests, and a stubbed `fetchImpl` can drive this end-to-end offline.
- */
-declare function callOpenAiCompat(opts: CallLocalOptions): Promise<string>;
-
 /**
  * IR enum → `query({options})` mapping — the core of this back-end, the TS analogue of the
  * file target's `emit.rs`. Keyed on the **three orthogonal IR enums** (`realization_kind`,
@@ -575,6 +659,8 @@ interface DispatchMeta {
      *  beyond `wren` and Write/Edit are scoped to this root, instead of denied outright. `null` on the
      *  hybrid-staged path (out of scope — see buildHybridStagedPlan). */
     setupScope: string | null;
+    /** True when this plan requires the prepared-registry component runtime, not plain runDispatch. */
+    componentInvocation?: boolean;
 }
 interface DispatchPlan {
     /** The user question (assembled prompt for `query()`). */
@@ -837,6 +923,8 @@ interface Trace {
     /** Per assistant turn (per-step granularity the headless file target can't produce). */
     steps: StepUsage[];
     denials: Denial[];
+    /** Redacted parent/child attempt telemetry. Payloads and provider errors are never included. */
+    componentCalls?: ComponentCallTrace[];
 }
 /** Pure: fold the captured message stream + guardrail denials into a trace. */
 declare function aggregateTrace(messages: readonly SDKMessage[], meta: {
@@ -886,6 +974,19 @@ interface RunConfig {
      * changed across the run, which is itself the finding.
      */
     onPromptFingerprint?: (fingerprint: PromptFingerprint) => void;
+    /**
+     * The IR file this plan came from, and the IR itself — supplied together to land the assets its
+     * components declare into the working directory before the agent runs.
+     *
+     * Optional because a caller that built a plan without an IR file on disk (a test, a programmatic
+     * IR) has nothing to land from. Omitting it on a plan whose components DO declare assets means the
+     * agent runs without them, which is the pre-existing behaviour this closes — so a host that can
+     * supply it should.
+     */
+    assets?: {
+        ir: WarbleIr;
+        irPath: string;
+    };
 }
 /**
  * A dispatch failure that still carries the SDK's session id, when the result message had one —
@@ -904,89 +1005,385 @@ declare class DispatchSessionError extends DispatchError {
  */
 declare function runDispatch(plan: DispatchPlan, cfg: RunConfig): Promise<RunResult>;
 
+interface DispatchInput {
+    /** A parsed IR or a raw JSON string. */
+    ir: WarbleIr | string;
+    /**
+     * What this host says about each declared slot: a variant name to render, `null` to remove the
+     * slot because its `present_when` does not hold, or nothing at all to take the declared default.
+     *
+     * The IR carries every variant and picks none — picking is the host's job, and so is answering a
+     * condition. Omit this entirely for an IR that declares no slots; supplying it then is harmless
+     * but pointless. An IR that DOES declare a conditional slot and gets no answer for it is a loud
+     * failure rather than a silent default (see `resolveSlots`).
+     */
+    slots?: SlotSupply;
+    /** The data question to answer (the `query()` prompt). Optional for prepare-only (dry-run/emit). */
+    question?: string;
+    target?: string;
+    flavor?: RenderFlavor;
+    models?: ModelConfig;
+    maxTurns?: number;
+    /** Explicit bound-project cwd (absolute or cwd-relative). Overrides `irPath`-based resolution. */
+    project?: string;
+    /** Resolve each node's relative `context_binding.project` against this IR file's directory. */
+    irPath?: string;
+    /**
+     * Scope preparation to this root id and its complete transitive component-call closure. An
+     * unreachable sibling is left untouched, so its model, slots, assets, capabilities, guardrails,
+     * effect and trigger never enter this dispatch's preflight. Use this for `chat`, which starts one
+     * root per process.
+     *
+     * Omit (the default) to prepare every component in the IR — the shape `manifest`, `emit`, and
+     * the whole-profile `dispatch` subcommand need, since each of those actually reads or runs
+     * every component and must know every component's resolution, not just one's.
+     *
+     * This narrows *which closure's* requirements gate a call; it does not weaken a failed
+     * capability. Reachable callees are fully planned under their own authority and stored in the
+     * prepared-callee registry, never appended to the root plan list or started automatically.
+     */
+    componentId?: string;
+}
+interface PreparedComponent {
+    id: string;
+    node: ComponentNode;
+    report: ResolutionReport;
+    plan: DispatchPlan;
+    /** Every IR step with its own runtime model/provider binding, retained for trusted step execution. */
+    steps: readonly StagedStep[];
+    role: "entry" | "callee";
+}
+interface PreparedDispatch {
+    target: string;
+    profile: string;
+    /** Backwards-compatible root plan list. Reachable callees never appear here merely by reachability. */
+    components: PreparedComponent[];
+    /** Immutable records addressable only through the authorized dependency table. */
+    preparedCallees: readonly PreparedComponent[];
+    entries: readonly EntryClosure[];
+    dependencies: readonly ComponentDependency[];
+}
+/** Stable redacted status for a component the configured target cannot run. */
+declare const UNAVAILABLE_COMPONENT_REASON = "component is unavailable on the configured runtime";
+interface UnavailableDisplayComponent {
+    id: string;
+    node: ComponentNode;
+    /** Read-only diagnostic resolution; never an executable capability grant. */
+    inspection: ResolutionReport;
+    availability: {
+        status: "unavailable";
+        reason: typeof UNAVAILABLE_COMPONENT_REASON;
+    };
+}
 /**
- * The orchestrator's system prompt — PROVIDER-AGNOSTIC. Lists the steps in order by name and the
- * produces→consumes marshaling; it never says which step is local vs cloud (that is the handler's job,
- * from the binding). So the same prompt shape is emitted whether the binding is all-cloud or hybrid.
- */
-declare function buildToolDriverPrompt(steps: readonly StagedStep[]): string;
-/**
- * Run the hybrid-tool path: one orchestrator query() + a `dispatch_step` tool that routes each step to
- * its bound provider. Mirrors {@link runHybridStaged}'s outputs (result.txt / trace.json / RunResult).
- */
-declare function runHybridTool(plan: DispatchPlan, cfg: RunConfig): Promise<RunResult>;
-
-/**
- * What a host says about each slot, keyed by slot name:
+ * A component in a display manifest that the target CAN run.
  *
- * - a string — render this variant;
- * - `null` — the slot's `present_when` does not hold, so remove it entirely;
- * - absent — the host has no opinion, so render the declared `default`.
+ * Deliberately **not** a {@link PreparedComponent}: it carries no `plan`. A plan built for a display
+ * is resolved under the lenient unanswered-condition policy, so handing one out would let a consumer
+ * do the natural "preview it, then dispatch what was previewed" — `runDispatch(component.plan, cfg)`
+ * type-checks with no cast — and send a model wording for a condition nobody ever answered. That is
+ * exactly the failure the strict policy exists to prevent, arriving through the display door.
  *
- * A plain table rather than a callback, so what the model was told is decided before the run rather
- * than during it: it can be recorded, compared and fingerprinted. A callback could not be.
+ * A plan is still built during preparation, because that is what surfaces an unsupported enum as a
+ * wall-hit; it is discarded rather than returned. Nothing in the manifest builders reads it.
  */
-type SlotSupply = Readonly<Record<string, string | null>>;
+interface AvailableDisplayComponent {
+    id: string;
+    node: ComponentNode;
+    report: ResolutionReport;
+}
+type DisplayComponent = AvailableDisplayComponent | UnavailableDisplayComponent;
+interface PreparedDisplayManifest {
+    target: string;
+    profile: string;
+    components: readonly DisplayComponent[];
+    entries: readonly EntryClosure[];
+    dependencies: readonly ComponentDependency[];
+}
 /**
- * What to do with a conditional slot the host did not answer.
- *
- * `"fail"` on any path whose text reaches a model: `default` covers "no opinion on the wording", and
- * it cannot cover "no opinion on whether this exists at all" — defaulting there ships instructions
- * for a capability that may have been withheld, which is the failure `present_when` exists to
- * prevent.
- *
- * `"default"` on a display path. The rule above protects a model, not a reader, and a structural
- * view that refuses to render a valid profile is worse than one showing the default wording. Note
- * this is a real difference in meaning, not a relaxation for convenience: a display says "this is
- * what the default binding would say", never "this is what will be sent".
+ * Resolve a node's bound wren project to an absolute cwd. Relative `context_binding.project` paths
+ * resolve against the IR file's directory (`irPath`) when given, else the current working directory;
+ * an explicit `project` always wins.
  */
-type UnansweredCondition = "fail" | "default";
+declare function resolveProjectCwd(node: ComponentNode, opts: {
+    project?: string;
+    irPath?: string;
+}): string;
 /**
- * Resolve each declared slot to the text that will replace its references, or to `null` when the
- * host said it is not present.
- *
- * A slot's chosen variant may itself reference other slots — the compiler collects references from
- * variant text and validates them, so this is authored-legal — hence the recursion, with a visiting
- * set so a cycle is reported rather than spun on.
+ * Parse + resolve + build every requested component's `query({options})`, without calling the SDK.
  *
- * @param decls every slot in scope for the text being resolved. That is the profile's slots PLUS
- *   the component's, together: compile checks the two layers separately, but it also folds the
- *   profile's `system_prompt` into each component's `brief` (`render_brief`), so by the time a
- *   consumer sees the IR one string carries references from both. Names are unique project-wide —
- *   compile refuses a collision — which is what makes one combined table unambiguous.
- * @param supply the host's table.
- * @param scope names the scope in errors ("component 'x'").
+ * By default this prepares every advertised entry and the union of their closures. Pass
+ * `input.componentId` to scope preparation to one advertised root and its transitive callees;
+ * components outside that closure are never consulted. See {@link DispatchInput.componentId}.
  */
-declare function resolveSlots(decls: readonly SlotDecl[], supply: SlotSupply, scope: string, unanswered?: UnansweredCondition): ReadonlyMap<string, string | null>;
+declare function prepareDispatch(input: DispatchInput): PreparedDispatch;
 /**
- * Apply a resolved scope to one piece of prompt text.
- *
- * A slot resolved to `null` leaves nothing behind — deliberately the empty string rather than any
- * variant, since the point of a condition that does not hold is that the wording must not appear.
+ * Prepare a display-only whole-profile manifest. Unsupported components are
+ * represented by a closed unavailable marker; no executable plan is built
+ * for them. This must never be used by emit, dispatch, or chat.
  */
-declare function applySlots(raw: string, resolved: ReadonlyMap<string, string | null>, scope: string): string;
+declare function prepareDisplayManifest(input: Omit<DispatchInput, "componentId" | "question">): PreparedDisplayManifest;
+interface DispatchRunConfig {
+    outDir: string;
+    warbleBin?: string;
+    title?: string;
+    /** Host-lowered root invocation limits. Defaults are fixed by the composition specification. */
+    componentLimits?: ComponentInvocationLimits;
+    /** Root cancellation propagated into all active child query() calls. */
+    signal?: AbortSignal;
+    /** Deterministic host/test seam; production omits this and uses fresh Agent SDK query() calls. */
+    componentStepRunner?: ComponentStepRunner;
+    /** Embedder enforcement runs before each component's own immutable guardrail floor. */
+    hostCanUseTool?: Options["canUseTool"];
+    hostHooks?: Options["hooks"];
+}
+interface ComponentOutcome {
+    id: string;
+    report: ResolutionReport;
+    plan: DispatchPlan;
+    result: RunResult;
+}
+interface DispatchOutcome {
+    target: string;
+    components: ComponentOutcome[];
+}
 /**
- * Refuse prompt text that still carries a slot reference.
- *
- * The guard, not a formality. Every other failure in this file is loud on its own; this one catches
- * the case where a surface was never routed through {@link applySlots} at all — a new prompt-carrying
- * field, a path that assembles text somewhere unexpected — which is exactly how the original defect
- * arrived: the IR grew slots and nothing downstream was taught to consume them.
+ * Verify every reachable mount's travelling assets without writing them. This is intentionally a
+ * separate executable preflight from pure graph preparation: it reads the filesystem, but still
+ * completes before a model, session, output directory, or asset target is created.
  */
-declare function assertNoSlotReferences(raw: string, owner: string): void;
+declare function preflightDispatchAssets(input: DispatchInput, prepared: PreparedDispatch): void;
 /**
- * Parse repeated `--slot name=variant` / `--slot name=` flags into a {@link SlotSupply}.
+ * Prepare then RUN each component against the live Agent SDK loop. Requires `input.question`.
+ * Writes each run's artifacts under `runCfg.outDir` (see {@link runDispatch}).
+ */
+declare function dispatch(input: DispatchInput, runCfg: DispatchRunConfig): Promise<DispatchOutcome>;
+
+declare const DEFAULT_COMPONENT_INVOCATION_LIMITS: Readonly<{
+    maxDepth: 8;
+    maxAttempts: 32;
+    maxRequestBytes: 65536;
+    maxResultBytes: 1048576;
+    maxTurns: 40;
+    maxTurnsPerChild: 12;
+}>;
+interface ComponentInvocationLimits {
+    maxDepth?: number;
+    maxAttempts?: number;
+    maxRequestBytes?: number;
+    maxResultBytes?: number;
+    maxTurns?: number;
+    maxTurnsPerChild?: number;
+    /** Rejected by the Agent SDK composition preflight until provider spend is reservable. */
+    maxCostUsd?: number;
+    deadlineAt?: number;
+}
+interface ComponentInvocationRequest {
+    request: string;
+    input?: Record<string, unknown>;
+}
+interface ComponentProvenance {
+    verified?: boolean;
+    definition?: unknown;
+}
+type ComponentInvocationResult = {
+    status: "ok";
+    output: {
+        kind: "value";
+        value: unknown;
+    } | {
+        kind: "render";
+        blocks: Record<string, unknown>[];
+        summary?: string;
+    };
+    provenance?: ComponentProvenance;
+} | {
+    status: "refused";
+    code: "callee_refused";
+    message: string;
+} | {
+    status: "error";
+    code: "unsupported_callee" | "invalid_request" | "invalid_result" | "budget_exhausted" | "cancelled" | "transient_transport" | "callee_failed";
+    message: string;
+    retryable: boolean;
+};
+type ComponentCallStatus = "ok" | "refused" | "error" | "cancelled" | "late_discarded";
+interface ComponentCallTrace {
+    call_id: string;
+    parent_call_id: string | null;
+    caller_mount: string;
+    trusted_step_id: string;
+    alias: string;
+    callee_mount: string;
+    attempt: number;
+    depth: number;
+    admitted_at: number;
+    completed_at: number;
+    status: ComponentCallStatus;
+    request_bytes: number;
+    result_bytes: number;
+    model_turns: number;
+    total_cost_usd: number;
+    token_usage: {
+        input_tokens: number;
+        output_tokens: number;
+        cache_creation_input_tokens: number;
+        cache_read_input_tokens: number;
+    } | null;
+    degradation: string | null;
+}
+interface ComponentStepUsage {
+    model: string;
+    usage: unknown;
+}
+interface ComponentStepResult {
+    text: string;
+    turns: number;
+    totalCostUsd: number;
+    usage?: ComponentStepUsage[];
+    degradation?: string | null;
+}
+/** A step failed after the provider exposed billable telemetry. The runtime must charge it. */
+declare class ComponentStepExecutionError extends DispatchError {
+    readonly telemetry: ComponentStepResult;
+    readonly retryable: boolean;
+    constructor(message: string, telemetry: ComponentStepResult, retryable: boolean);
+}
+interface ComponentStepRun {
+    rootRunId: string;
+    callId: string | null;
+    parentCallId: string | null;
+    component: PreparedComponent;
+    step: StagedStep;
+    request: Required<ComponentInvocationRequest>;
+    artifacts: Readonly<Record<string, string>>;
+    aliases: readonly string[];
+    signal: AbortSignal;
+    maxTurns: number;
+    invoke(alias: string, request: unknown): Promise<ComponentInvocationResult>;
+}
+type ComponentStepRunner = (run: ComponentStepRun) => Promise<ComponentStepResult>;
+interface ComponentRuntimeOptions {
+    prepared: PreparedDispatch;
+    runStep: ComponentStepRunner;
+    limits?: ComponentInvocationLimits;
+    signal?: AbortSignal;
+    now?: () => number;
+    newId?: () => string;
+}
+interface ComponentRootResult {
+    finalText: string;
+    turns: number;
+    totalCostUsd: number;
+    usage: ComponentStepUsage[];
+    componentCalls: ComponentCallTrace[];
+}
+declare function normalizeComponentRequest(value: unknown, maxBytes?: number): {
+    value: Required<ComponentInvocationRequest>;
+    bytes: number;
+} | {
+    error: ComponentInvocationResult;
+};
+declare function normalizeComponentResult(finalText: string, renderContract: readonly RenderBlock[], maxBytes?: number): {
+    value: ComponentInvocationResult;
+    bytes: number;
+};
+declare function assertEligibleComponentCallee(component: PreparedComponent): void;
+/** A root caller may own the final render path, but its model step stays read-only and SDK-bound. */
+declare function assertEligibleComponentCaller(component: PreparedComponent): void;
+declare class ComponentInvocationRuntime {
+    private readonly options;
+    readonly rootRunId: string;
+    readonly componentCalls: ComponentCallTrace[];
+    private readonly limits;
+    private readonly abortController;
+    private readonly now;
+    private readonly newId;
+    private readonly byId;
+    private readonly edgeByStep;
+    private readonly descendantDepth;
+    private attempts;
+    private availableTurns;
+    private totalTurnsObserved;
+    private totalCostUsd;
+    private readonly allUsage;
+    private cancelledAt;
+    private deadlineTimer;
+    constructor(options: ComponentRuntimeOptions);
+    get signal(): AbortSignal;
+    cancel(): void;
+    runRoot(componentId: string, request: ComponentInvocationRequest): Promise<ComponentRootResult>;
+    private throwIfCancelled;
+    private aliasesFor;
+    private availableFor;
+    private charge;
+    private maxDescendantDepth;
+    private descendantDepthForStep;
+    /** Reserve an active root SDK query before its synchronous child handlers may be admitted. */
+    private reserveRootStep;
+    private executeComponent;
+    private enqueueInvocation;
+    private invoke;
+}
+
+/**
+ * Minimal OpenAI-compatible chat client for the hybrid-staged path (see docs/spec/capability-model.md §7.2).
  *
- * Lives here rather than in the CLI so it is reachable by a test and by any host that wants the same
- * surface; the CLI turns the thrown error into its own usage failure. Mirrors the Rust CLI's flag of
- * the same name — two user-facing surfaces that disagreed about what `name=` means would be worse
- * than either one alone.
+ * A local step (provider `openai_compat`, e.g. ollama's `http://localhost:11434/v1`) is executed by
+ * calling `POST {endpoint}/chat/completions` directly — NOT through the Claude SDK, whose `agents[].model`
+ * is a restricted alias union that loud-fails on a local model id (SDK-NOTES.md #1). ollama speaks the
+ * OpenAI Chat Completions shape, not the Anthropic Messages shape, so this is a distinct, deliberately
+ * tiny client — no streaming, no tools, no retries. It is the "third provider-aware back-end" embryo:
+ * enough to prove a per-step local model can be marshaled into a cloud run, not a production LLM client.
  *
- * An empty value is **not** an empty variant name: it is the host saying the slot's condition does
- * not hold and the wording must not appear at all. That distinction is why the flag takes a trailing
- * `=` rather than requiring a variant.
+ * Live-gated: exercised only when an ollama (or other OpenAI-compat) endpoint is reachable. The request
+ * SHAPING is unit-tested via {@link buildChatRequest} with no network.
  */
-declare function parseSlotFlags(flags: readonly string[]): SlotSupply;
+
+interface ChatRequest {
+    model: string;
+    messages: StepMessage[];
+    stream: false;
+    /** Deterministic-leaning default; a local step is a bounded transform, not open-ended generation. */
+    temperature: number;
+}
+/** Build the JSON body for an OpenAI-compatible `/chat/completions` call. Pure (no network). */
+declare function buildChatRequest(model: string, messages: StepMessage[]): ChatRequest;
+/** Extract the assistant text from an OpenAI-compatible completion response. Pure. */
+declare function extractCompletionText(body: unknown): string;
+interface CallLocalOptions {
+    endpoint: string;
+    model: string;
+    messages: StepMessage[];
+    /** Optional bearer token (ollama ignores it; other OpenAI-compat servers may require it). */
+    apiKey?: string;
+    /** Injectable for tests; defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Call an OpenAI-compatible chat endpoint and return the assistant text. Live-gated (needs a reachable
+ * endpoint); the request/response shaping is covered by {@link buildChatRequest} /
+ * {@link extractCompletionText} tests, and a stubbed `fetchImpl` can drive this end-to-end offline.
+ */
+declare function callOpenAiCompat(opts: CallLocalOptions): Promise<string>;
+
+/**
+ * The orchestrator's system prompt — PROVIDER-AGNOSTIC. Lists the steps in order by name and the
+ * produces→consumes marshaling; it never says which step is local vs cloud (that is the handler's job,
+ * from the binding). So the same prompt shape is emitted whether the binding is all-cloud or hybrid.
+ */
+declare function buildToolDriverPrompt(steps: readonly StagedStep[]): string;
+/**
+ * Run the hybrid-tool path: one orchestrator query() + a `dispatch_step` tool that routes each step to
+ * its bound provider. Mirrors {@link runHybridStaged}'s outputs (result.txt / trace.json / RunResult).
+ */
+declare function runHybridTool(plan: DispatchPlan, cfg: RunConfig): Promise<RunResult>;
+
+/** The directory an IR's assets travel in, derived from the IR's own path. Mirrors the Rust CLI's. */
+declare function assetDirForIr(irPath: string): string;
+/** Executable-preflight probe: verify every asset before model/session/output work begins. */
+declare function validateAssets(ir: WarbleIr, irPath: string, cwd: string): void;
+declare function landAssets(ir: WarbleIr, irPath: string, cwd: string): string[];
 
 interface RenderResult {
     outPath: string;
@@ -1003,6 +1400,22 @@ declare function renderEnvelope(finalText: string, outPath: string, opts: {
     title?: string;
 }): RenderResult;
 
+declare function createSdkComponentStepRunner(cfg?: Pick<ComposedRunConfig, "onPromptFingerprint" | "hostCanUseTool" | "hostHooks">): {
+    runStep: ComponentStepRunner;
+    denials: Denial[];
+};
+interface ComposedRunConfig extends RunConfig {
+    prepared: PreparedDispatch;
+    root: PreparedComponent;
+    limits?: ComponentInvocationLimits;
+    signal?: AbortSignal;
+    runStep?: ComponentStepRunner;
+    hostCanUseTool?: Options["canUseTool"];
+    hostHooks?: Options["hooks"];
+}
+/** Execute one prepared root and its authorized descendants. Only this root path persists output. */
+declare function runComposedDispatch(plan: DispatchPlan, cfg: ComposedRunConfig): Promise<RunResult>;
+
 /**
  * A minimal structured snapshot of what a turn resolved — filters/dimensions/measures/grain — used
  * only to thread context into the NEXT turn's prompt. Nothing here is inferred by this module: a
@@ -1108,138 +1521,6 @@ declare class ChatSession {
 }
 declare function createChatSession(plan: DispatchPlan, runCfg: RunConfig, initialResumeSessionId?: string): ChatSession;
 
-interface DispatchInput {
-    /** A parsed IR or a raw JSON string. */
-    ir: WarbleIr | string;
-    /**
-     * What this host says about each declared slot: a variant name to render, `null` to remove the
-     * slot because its `present_when` does not hold, or nothing at all to take the declared default.
-     *
-     * The IR carries every variant and picks none — picking is the host's job, and so is answering a
-     * condition. Omit this entirely for an IR that declares no slots; supplying it then is harmless
-     * but pointless. An IR that DOES declare a conditional slot and gets no answer for it is a loud
-     * failure rather than a silent default (see `resolveSlots`).
-     */
-    slots?: SlotSupply;
-    /** The data question to answer (the `query()` prompt). Optional for prepare-only (dry-run/emit). */
-    question?: string;
-    target?: string;
-    flavor?: RenderFlavor;
-    models?: ModelConfig;
-    maxTurns?: number;
-    /** Explicit bound-project cwd (absolute or cwd-relative). Overrides `irPath`-based resolution. */
-    project?: string;
-    /** Resolve each node's relative `context_binding.project` against this IR file's directory. */
-    irPath?: string;
-    /**
-     * Scope preparation to exactly this component id: only its capabilities are resolved and only
-     * its plan is built — every *other* component in the IR is left untouched, so its
-     * `required_capabilities` never enter this dispatch's preflight. Use this for `chat`, which
-     * only ever runs one component per process.
-     *
-     * Omit (the default) to prepare every component in the IR — the shape `manifest`, `emit`, and
-     * the whole-profile `dispatch` subcommand need, since each of those actually reads or runs
-     * every component and must know every component's resolution, not just one's.
-     *
-     * This narrows *which* component's requirements gate a given `prepareDispatch` call — it does
-     * not change what happens when a gated capability is unmet (still a loud throw, same message,
-     * same named capability; see `resolveNodeCapabilities`). A component that can itself invoke
-     * another IR component at runtime would need that callee's requirements folded in here too, but
-     * no such reachability exists yet: `borrowed_actions` names external runtime actions (notify,
-     * ticket, …), never another component, and the one mechanism shaped for it — `orchestrating` /
-     * `effect.outcome.kind: "dispatch"` with `routable_scope` — is parsed but not consumed by any
-     * back-end (`docs/spec/authoring.md` marks `orchestrating` "scaffolded", not realized). If that
-     * ever lands, this scoping must fold in the callee's requirements too.
-     */
-    componentId?: string;
-}
-interface PreparedComponent {
-    id: string;
-    node: ComponentNode;
-    report: ResolutionReport;
-    plan: DispatchPlan;
-}
-interface PreparedDispatch {
-    target: string;
-    components: PreparedComponent[];
-}
-/** Stable redacted status for a component the configured target cannot run. */
-declare const UNAVAILABLE_COMPONENT_REASON = "component is unavailable on the configured runtime";
-interface UnavailableDisplayComponent {
-    id: string;
-    node: ComponentNode;
-    availability: {
-        status: "unavailable";
-        reason: typeof UNAVAILABLE_COMPONENT_REASON;
-    };
-}
-/**
- * A component in a display manifest that the target CAN run.
- *
- * Deliberately **not** a {@link PreparedComponent}: it carries no `plan`. A plan built for a display
- * is resolved under the lenient unanswered-condition policy, so handing one out would let a consumer
- * do the natural "preview it, then dispatch what was previewed" — `runDispatch(component.plan, cfg)`
- * type-checks with no cast — and send a model wording for a condition nobody ever answered. That is
- * exactly the failure the strict policy exists to prevent, arriving through the display door.
- *
- * A plan is still built during preparation, because that is what surfaces an unsupported enum as a
- * wall-hit; it is discarded rather than returned. Nothing in the manifest builders reads it.
- */
-interface AvailableDisplayComponent {
-    id: string;
-    node: ComponentNode;
-    report: ResolutionReport;
-}
-type DisplayComponent = AvailableDisplayComponent | UnavailableDisplayComponent;
-interface PreparedDisplayManifest {
-    target: string;
-    components: DisplayComponent[];
-}
-/**
- * Resolve a node's bound wren project to an absolute cwd. Relative `context_binding.project` paths
- * resolve against the IR file's directory (`irPath`) when given, else the current working directory;
- * an explicit `project` always wins.
- */
-declare function resolveProjectCwd(node: ComponentNode, opts: {
-    project?: string;
-    irPath?: string;
-}): string;
-/**
- * Parse + resolve + build every requested component's `query({options})`, without calling the SDK.
- *
- * By default this prepares every component in the IR. Pass `input.componentId` to scope
- * preparation — and therefore capability resolution — to exactly that one component; every other
- * component's `required_capabilities` are never consulted, so a component that isn't being
- * dispatched can't wall-hit a dispatch it has nothing to do with. See {@link DispatchInput.componentId}.
- */
-declare function prepareDispatch(input: DispatchInput): PreparedDispatch;
-/**
- * Prepare a display-only whole-profile manifest. Unsupported components are
- * represented by a closed unavailable marker; no executable plan is built
- * for them. This must never be used by emit, dispatch, or chat.
- */
-declare function prepareDisplayManifest(input: Omit<DispatchInput, "componentId" | "question">): PreparedDisplayManifest;
-interface DispatchRunConfig {
-    outDir: string;
-    warbleBin?: string;
-    title?: string;
-}
-interface ComponentOutcome {
-    id: string;
-    report: ResolutionReport;
-    plan: DispatchPlan;
-    result: RunResult;
-}
-interface DispatchOutcome {
-    target: string;
-    components: ComponentOutcome[];
-}
-/**
- * Prepare then RUN each component against the live Agent SDK loop. Requires `input.question`.
- * Writes each run's artifacts under `runCfg.outDir` (see {@link runDispatch}).
- */
-declare function dispatch(input: DispatchInput, runCfg: DispatchRunConfig): Promise<DispatchOutcome>;
-
 /**
  * Codegen (`emit`) — freeze a prepared dispatch into an importable TS agent module.
  *
@@ -1319,6 +1600,7 @@ interface GuardrailManifest {
 }
 interface AvailableAgentManifest {
     id: string;
+    entrypoint: boolean;
     verb: string;
     component_type: ComponentNode["type"];
     realization_kind: ComponentNode["realization_kind"];
@@ -1329,11 +1611,13 @@ interface AvailableAgentManifest {
     tools: ToolRef[];
     output_schema: unknown;
     capabilities: ResolutionReport;
+    dependencies: ComponentDependencyManifest[];
     brief?: string;
 }
 /** A display-only declaration of a component that remains unavailable to this target. */
 interface UnavailableAgentManifest {
     id: string;
+    entrypoint: boolean;
     verb: string;
     component_type: ComponentNode["type"];
     realization_kind: ComponentNode["realization_kind"];
@@ -1345,17 +1629,34 @@ interface UnavailableAgentManifest {
     tools: [];
     output_schema: Record<string, never>;
     capabilities: [];
+    capability_inspection: ResolutionReport;
+    dependencies: ComponentDependencyManifest[];
     availability: {
         status: "unavailable";
         reason: string;
     };
 }
 type AgentManifest = AvailableAgentManifest | UnavailableAgentManifest;
+type ComponentDependencyManifest = Omit<ComponentDependency, "caller">;
+interface EntryManifest {
+    id: string;
+    closure: string[];
+    availability: {
+        status: "available";
+    } | {
+        status: "unavailable";
+        reason: string;
+    };
+    /** Null when the entry's closure declares no component invocation. */
+    invocation_realization: ResolvedCapability | null;
+}
 interface Manifest {
     manifest_version: string;
     compat: CompatibilityPolicy;
     profile: string;
     target: string;
+    /** Selectable roots only. Internal mounts remain visible under `agents`, never here. */
+    entries: EntryManifest[];
     agents: AgentManifest[];
 }
 /** Port of `emit.rs::build_agent_bundle`, minus the tool-map parameter (this back-end's is fixed,
@@ -1365,12 +1666,12 @@ interface Manifest {
  * it satisfies this structurally — but nothing here reads a plan, so nothing here should require
  * one; see `AvailableDisplayComponent` for why a display must not carry it.
  */
-declare function buildAgentManifest(component: AvailableDisplayComponent): AvailableAgentManifest;
+declare function buildAgentManifest(component: AvailableDisplayComponent, dependencies?: readonly ComponentDependency[]): AvailableAgentManifest;
 /** Never derives a plan, tool, or capability grant for an unavailable component. */
-declare function buildUnavailableAgentManifest(component: UnavailableDisplayComponent): UnavailableAgentManifest;
+declare function buildUnavailableAgentManifest(component: UnavailableDisplayComponent, dependencies?: readonly ComponentDependency[]): UnavailableAgentManifest;
 /** Build the full display manifest for a `prepareDispatch` result. `raw` is the same IR the
  * dispatch was prepared from — re-parsed here (a second, cheap, pure parse) just to read
  * `profile`, which `PreparedDispatch` does not itself carry. */
 declare function buildManifest(prepared: PreparedDispatch | PreparedDisplayManifest, raw: string): Manifest;
 
-export { type AgentManifest, type AskOptions, type AvailableAgentManifest, type AvailableDisplayComponent, type BuildConfig, COMPONENT_TYPES, type CallLocalOptions, type CapabilityEntry, type CapabilityOutcome, type CapabilityProfile, type ChatRequest, ChatSession, type ClarifyOutcome, type CompatibilityPolicy, type ComponentNode, type ComponentOutcome, type ComponentType, type ContextBinding, type Criticality, DEFAULT_CLARIFY_THRESHOLD, DEFAULT_RENDER_FLAVOR, DEFAULT_TARGET, DESTRUCTIVE_BASH_DENY, type Denial, type DiscoverClaudeModelsOptions, DispatchError, type DispatchInput, type DispatchMeta, type DispatchOutcome, type DispatchPlan, type DispatchRunConfig, DispatchSessionError, type DisplayComponent, type Effect, type EmitOptions, type GateFailureMode, type GateKind, type GuardConfig, type Guardrail, type GuardrailManifest, type IrConfig, type LlmCall, MODEL_CATALOG_VERSION, type Manifest, type ModelCatalogModel, type ModelCatalogResult, type ModelCatalogUnavailableCode, ModelConfig, OUTCOME_KINDS, type Outcome, type OutcomeKind, type PreconditionResult, type PreparedComponent, type PreparedDispatch, type PreparedDisplayManifest, type PromptFingerprint, type ProvidedBy, type Provider, REALIZATION_KINDS, type RealizationKind, type RenderBlock, type RenderFlavor, type RenderGate, type RenderResult, type ResolutionReport, type ResolvedCapability, type ResolvedIntent, type RoutingMode, type RoutingPlan, type RunConfig, type RunResult, SUPPORTED_IR_VERSIONS, type SessionState, type SlotSupply, type StagedStep, type StepManifest, type StepMessage, type StepRealization, type StepUsage, TRIGGER_KINDS, type TargetId, type TierBinding, type ToolPlan, type ToolRef, type Trace, type Trigger, type TriggerKind, type Turn, type TurnResult, UNAVAILABLE_COMPONENT_REASON, type UnansweredCondition, type UnavailableAgentManifest, type UnavailableDisplayComponent, type WarbleIr, type WhenGuardOut, aggregateTrace, appendTurn, applySlots, assertNoSlotReferences, buildAgentManifest, buildChatRequest, buildDispatchPlan, buildManifest, buildStepMessages, buildToolDriverPrompt, buildTurnPrompt, buildUnavailableAgentManifest, callOpenAiCompat, collectRequiredCapabilities, composeCanUseTool, composeHooks, createChatSession, createSessionState, decideClarify, discoverClaudeModels, dispatch, distillFollowup, distinctProviders, distinctTiers, emitAgentModule, extractCompletionText, fingerprintPrompts, fingerprintSurfaces, inspectNodeCapabilities, isKnownTarget, knownTargetNames, lastResolvedIntent, lastSessionId, localProfile, makeReadOnlyGuard, parseIr, parseRenderFlavor, parseSlotFlags, planProviderRouting, prepareDispatch, prepareDisplayManifest, profileFor, promptSurfaces, promptSurfacesOf, renderEnvelope, resolveCapabilities, resolveNodeCapabilities, resolveProjectCwd, resolveSlots, resolveStagedSteps, runDispatch, runHybridTool, shouldSplitPerStepTier, usesLocalProvider };
+export { type AgentManifest, type AskOptions, type AvailableAgentManifest, type AvailableDisplayComponent, type BuildConfig, COMPONENT_TYPES, type CallLocalOptions, type CapabilityEntry, type CapabilityOutcome, type CapabilityProfile, type ChatRequest, ChatSession, type ClarifyOutcome, type CompatibilityPolicy, type ComponentCall, type ComponentCallTrace, type ComponentClosurePlan, type ComponentDependency, type ComponentDependencyManifest, type ComponentInvocationLimits, type ComponentInvocationRequest, type ComponentInvocationResult, ComponentInvocationRuntime, type ComponentNode, type ComponentOutcome, type ComponentRootResult, ComponentStepExecutionError, type ComponentStepResult, type ComponentStepRun, type ComponentStepRunner, type ComponentType, type ComposedRunConfig, type ContextBinding, type Criticality, DEFAULT_CLARIFY_THRESHOLD, DEFAULT_COMPONENT_INVOCATION_LIMITS, DEFAULT_RENDER_FLAVOR, DEFAULT_TARGET, DESTRUCTIVE_BASH_DENY, type Denial, type DiscoverClaudeModelsOptions, DispatchError, type DispatchInput, type DispatchMeta, type DispatchOutcome, type DispatchPlan, type DispatchRunConfig, DispatchSessionError, type DisplayComponent, type Effect, type EmitOptions, type EntryClosure, type EntryManifest, type GateFailureMode, type GateKind, type GuardConfig, type Guardrail, type GuardrailManifest, type IrConfig, type LlmCall, MODEL_CATALOG_VERSION, type Manifest, type ModelCatalogModel, type ModelCatalogResult, type ModelCatalogUnavailableCode, ModelConfig, OUTCOME_KINDS, type Outcome, type OutcomeKind, type PreconditionResult, type PreparedComponent, type PreparedDispatch, type PreparedDisplayManifest, type PromptFingerprint, type ProvidedBy, type Provider, REALIZATION_KINDS, type RealizationKind, type RenderBlock, type RenderFlavor, type RenderGate, type RenderResult, type ResolutionReport, type ResolvedCapability, type ResolvedIntent, type RoutingMode, type RoutingPlan, type RunConfig, type RunResult, SUPPORTED_IR_VERSIONS, type SessionState, type SlotSupply, type StagedStep, type StepManifest, type StepMessage, type StepRealization, type StepUsage, TRIGGER_KINDS, type TargetId, type TierBinding, type ToolPlan, type ToolRef, type Trace, type Trigger, type TriggerKind, type Turn, type TurnResult, UNAVAILABLE_COMPONENT_REASON, type UnansweredCondition, type UnavailableAgentManifest, type UnavailableDisplayComponent, type WarbleIr, type WhenGuardOut, aggregateTrace, appendTurn, applySlots, assertEligibleComponentCallee, assertEligibleComponentCaller, assertNoSlotReferences, assetDirForIr, buildAgentManifest, buildChatRequest, buildDispatchPlan, buildManifest, buildStepMessages, buildToolDriverPrompt, buildTurnPrompt, buildUnavailableAgentManifest, callOpenAiCompat, collectRequiredCapabilities, componentDependencies, composeCanUseTool, composeHooks, createChatSession, createSdkComponentStepRunner, createSessionState, decideClarify, discoverClaudeModels, dispatch, distillFollowup, distinctProviders, distinctTiers, emitAgentModule, extractCompletionText, fingerprintPrompts, fingerprintSurfaces, inspectNodeCapabilities, isKnownTarget, knownTargetNames, landAssets, lastResolvedIntent, lastSessionId, localProfile, makeReadOnlyGuard, normalizeComponentRequest, normalizeComponentResult, parseIr, parseRenderFlavor, parseSlotFlags, planProviderRouting, preflightDispatchAssets, prepareDispatch, prepareDisplayManifest, profileFor, promptSurfaces, promptSurfacesOf, renderEnvelope, resolveCapabilities, resolveComponentClosure, resolveNodeCapabilities, resolveProjectCwd, resolveSlots, resolveStagedSteps, runComposedDispatch, runDispatch, runHybridTool, shouldSplitPerStepTier, usesLocalProvider, validateAssets };